git.stella-ops.org/docs/policy/editor.md

Policy Editor Guide

Imposed rule: Edits must run lint, simulate, and shadow+coverage gates before promotion; UI enforces attachment of results on submission.

This guide walks through the Console Policy Editor: authoring, validation, simulation, approvals, and offline workflow.

1. Workspace

• Left rail: policy list, versions, status (draft/submitted/approved/active/archived), shadow flag badge.
• Editor pane: YAML/SPL with schema validation, syntax highlighting, auto-format; shows IR hash after successful lint.
• Metadata panel: description, tags, AOC indicator, attestation status.
• Attachments panel: lint report, simulate diff, coverage results; mandatory before submission.

2. Validation

• Live lint via compiler service; blocks save on fatal errors.
• Schema assist: hover shows field descriptions; unknown fields flagged as warnings.
• Determinism check: twin-run diff runs on save; failures block submission.

3. Simulation

• Quick simulate: select fixtures (SBOM/VEX bundles) → runs in shadow mode; results shown inline with deltas vs previous version.
• Batch simulate: enqueue via orchestrator; results stored as attachments; required freshness <24h for submission.

4. Submission & approvals

• Submit requires: lint OK, simulate attachment, coverage results, shadow enabled.
• Reviewers comment inline; blocking comments must be resolved before approval.
• Approvers must enter reason/ticket; Authority enforces two-person rule when configured.

5. Promotion & activation

• Publish & sign: produces DSSE attestation over IR hash + approval metadata; Rekor mirror when online.
• Activate: selects approved version; records input cursors; triggers run if requested.
• Rollback: pick prior approved version; requires reason.

6. Offline workflow

• Load policy pack + attachments from Offline Kit; editor runs local lint/simulate with sealed inputs.
• Submit/approve offline records events locally; sync to Authority when reconnected.

7. Shortcuts & a11y

• Keyboard: Ctrl+S save, Ctrl+Shift+L lint, Ctrl+Shift+R simulate.
• Screen reader labels on editor, results table, and buttons; focus order follows workflow.

8. Troubleshooting

• Lint failures: open Problems tab; fix schema/unknown fields.
• Simulate stale: rerun quick simulate; ensure fixtures match policy inputs.
• Attestation mismatch: regenerate IR (auto) and retry publish; check Authority scopes.

References

• docs/policy/dsl.md
• docs/policy/spl-v1.md
• docs/policy/lifecycle.md
• docs/policy/runtime.md